I am using AWS Cognito with Federated identities to manage access to my app. The custom social identity provider that I use returns me some custom user attributes. The attributes are correctly mapped as user attributes in my user pool.
I recently realized that my users could change their own attributes using their accessToken. (using aws cognito-idp update-user-attribute for example). Is there a way to forbid this? I basically always want to keep the value returned by the provider.
I originally thought I could mark the attributes as non-writable, but this does not work as I need the social provider to be able to write it. Also, the doc mentions that I should keep it mutable.
Would using DeveloperOnlyAttribute work ? I did not try it so far as the doc basically says it is deprecated.